@login_required back for /
Added app.root_path to send_from_directory